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Abstract 

This paper shows that the BB84 protocol with random privacy ampli- 
fication is secure with a higher key rate than Mayers' estimate with the 
same error rate. Consequently, the tolerable error rate of this protocol is 
increased from 7.5 % to 11 %. We also extend this method to the case 
of estimating error rates separately in each basis, which enables us to se- 
curely share a longer key. 

Index Terms — Quantum key distribution, BB84, random privacy amplifi- 
cation, security analysis 



1 Introduction 

The BB84 protocol is the first quantum key distribution (QKD) protocol, which 
was proposed by Bennett and Brassard in 1984 T. Unlike conventional cryp- 
tographies that rely on the conjectured difficulty of computing certain functions, 
the security of QKD is guaranteed by the postulate of quantum mechanics. In 
the BB84 protocol, the participants (Alice and Bob) agree on a secret key about 
which any eavesdropper (Eve) can obtain little information. The security proof 
of this protocol against arbitrary eavesdropping strategies was first proved by 
Mayers and a simple proof was later shown by Shor and Preskill Later, 
many security analyses are studied [SI [3 |H1 ^] • 

In the BB84 protocol, two linear codes Ci and C2 are employed to share 
a secret key. Ci is used for error correction, and C2 is used for privacy am- 
plification. Error correction is performed to share the same key, which is not 

*Part of this paper will be presented in the 2005 International Symposium on Information 
Theory, Adelaide Convention Centre, Adelaide, Australia, 4—9 September, 2005. 
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necessarily secret. Privacy amplification is performed to extract a shorter se- 
cret key. To share the same secret key, C2 must be a subcode of Ci, and the 
decoding error probability of Ci and as a CSS code must be small. For the 
key distribution protocol to be practical, we require the linear code Ci to be 
efficiently decodeable. However, it is difficult to find a pair of linear codes Ci 
and C2 that satisfy these conditions. Because we do not have to decode C^, 
it is sufficient that is a randomly chosen code whose decoding error prob- 
ability is small with the maximum likelihood decoding. Mayers showed that if 
one determines Ci and chooses C2 with rate H(2p) at random from subcodes 
of Ci, the minimum Hamming weight of C^\Cj'" is greater than pn with high 
probability, where p is an estimated error rate and H(-) is the binary entropy 
function jS| Lemma 4] . Consequently, the decoding error probability of as a 
part of a CSS code is small. With this method, we can share a key with the key 
rate 1 — H(p) — H(2p), and the protocol can tolerate error rates up to 7.5%. In 
this paper, we call the random privacy amplification as the method such that 
one chooses C2 at random from subcodes of a fixed code Ci and performs the 
privacy amplification by C2. 

However, by evaluating directly the decoding error probability of instead 
of the minimum Hamming weight, we can decrease the rate of C2 while main- 
taining the security of the protocol. This paper shows that when one chooses C2 
with rate H(p) at random from subcodes of Ci, the decoding error probability of 
C2 as a part of a CSS code is exponentially small with high probability. Conse- 
quently, when we choose a code C2 at random in the BB84 protocol, according 
to our evaluation of decoding error probability, we can share a key with the key 
rate 1 — 2H(p) and the protocol can tolerate error rates up to 11%. 

To share a key more efficiently, it is known that we should estimate error 
rates, po and pi, separately in two basis {|0), |1)} and { 1 } El 

13 . This paper also shows that if one chooses C2 of a rate ^(p°)+^(pi) at 
random from subcodes of Ci , the decoding error probability of as a part of 
a CSS code is exponentially small with high probability, which is proved by an 
analogue method in Appendix B]. 

It is also known that QKD protocols with two-way classical communications 
can tolerate higher error rate than QKD protocols with one-way classical com- 
munications. The tolerable error rates are 18.9% in jT], 20% in ^J, and 26% 
in |10| . Our result on random privacy amplification is also applicable for those 
protocols, because they perform error correction and privacy amplification after 
reducing the error rate with two-way classical communications. 

We stress that our result is different from previously known results. In [Sj 
Lemma 4], it is proved that if we fix Ci of rate 1 — H(p) and choose its subcode 
C2 of rate H(2p) at random, the BB84 protocol is secure, which means that 
the BB84 protocol with random privacy amplification can tolerate the error 
rate of 7.5%. In [2], the authors state that there exists a pair of Ci and C2 
by which the BB84 protocol can tolerate the error rate of 11%. However, one 
cannot guarantee that Ci is efficiently decodeable. They also cite Lemma 
4] in order to show that we can securely choose a random subcode C2 of an 
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efficiently decodeable code Ci. However, it is not clarified in [2] whether or 
not the BB84 protocol with random privacy amplification can tolerate the 11% 
error rate. Other previous papers [SI El |H1 ^] are based on the result in 
12] • Thus nobody has proved that the BB84 protocol with random privacy 
amplification can tolerate the 11% error rate. We also stress that the random 
hashing method cannot be directly applied to the security proof of the BB84 
protocol with random privacy amplification as used in jl6| . because a fixed Ci 
and the condition C2 C Ci decrease the randomness of hashing. Application 
of the random hashing to a security proof of the random privacy amplification 
requires a careful argument similar to Section Oof this paper. 

This paper is organized as follows. In Section |21 we introduce the BB84 
protocol, and present the required conditions on Ci and C2. We also relate 
those conditions to the security of the BB84 protocol quantitatively. In Section 
13 the main theorem is proved. Concluding remarks are given in Section^ 

2 The BB84 protocol 

We consider the following BB84 protocol modified from [2]. As shown in 
ini El El Q]i we estimate error rates separately in two basis {|0), |1)} and 
{ 1°^^^^ , 1"^^^^ }. As is also mentioned in (21 El El, Alice and Bob agree on a 
random permutation tt after transmission of the qubits and use the linear codes 
scrambled by tt, where tt scrambles the n-bit vector within first ^ bits and latter 
f bits respectively, i.e., tt : (zi, • • • , , yi, • • • , y^) i-> (^^^(i), • • • , y^2(i)' 
• • • , 2/ii-2(f ))i a'^d TTi, 7r2 e are permutations on {1, • • • , ^}. By this proce- 
dure, we can securely share a key against general eavesdropping attacks with a 
linear code whose decoding error probability as a part of a CSS code is small 
over a BSC (Binary Symmetric Channel) 7, Lemmas 2, 3]. 

2.1 The BB84 protocol 

(1) Alice randomly select (4 + 9)n-hit strings k and a, and chooses a random 
permutation tt. 

(2) Alice repeats the following procedures for 1 < « < (4 + 9)n. If — 0, she 
creates either state |0) for fc^ = or |1) for fc^ = 1. If = 1, she creates 
either state 1+) for /c^ = or |— ) for fc^ = 1. We represent prepared states 
as 1^.), where (p. G {0, 1,+, -}, |+) = Ml, |-) = Mi. 

(3) Alice sends the resulting (4 + 9)n qubits \tpi) (g) • • • (g) |iy9(4+6))„) to Bob. 

(4) Bob receives the (4 + 9)n qubits (g) • • • ® \<fi(4+9)n)- 

(5) Bob randomly select (4 + 6')n-bit string b. 

(6) Bob repeats the following procedures for 1 < i < (4 + 9)n. If bi = 0, he 
measures with cr^. If 6^ = 1, he measures with a^- Then, measure- 
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ment result, +1 and —1, corresponds to fc^ = and fc^ = 1, respectively. 
After these procedures Bob will obtain k — (fci, • • • , fc(4+0)„). 

(7) Alice announces a and tt. 

(8) If Oi ^ bi, Alice and Bob discard i-th bit of k and k. With high probability, 
at least 2n bits remain, and there are at least n bits where ai ~ bi = 0, 
and there are at least n bits where ai — bi — 1 (if not, abort the protocol). 

(9) Alice chooses n bits where a,; = 6,; = 0, and divides them into two §-bit 
strings, Cq and do- She chooses n bits where ai = bi = 1, and divides them 
into two §-bit strings, Ci and di. Alice announces which bits are Cq, do, 
Ci, di. Then, Bob will obtain Cq = Cq + Eq, Ci = Ci + ei do = dg + /o, 
di = di + where eo, ei, /o, /i are errors caused by eavesdropping and 
channel noise. 

(10) Alice and Bob compare dp with do and di with di, then they obtain fo 
and fi . From fa, fi, Alice and Bob choose a pair of linear codes Ci and 
6*2 that satisfy the conditions ijnjl-ljsl) in Section If there exists no 
such a pair of linear codes, then they abort the protocol. 

(11) Alice chooses a random codeword v from 7r(Ci) whose length is n, where 
7r(Ci) is a code that all codewords in Ci are permuted by tt. She sends 
X = V + c with a public classical channel, where c is a concatenation of 
Co and ci. 

(12) Bob receives x = v + c and subtracts c from it. Then, he corrects v + e 
to a codeword v in 7r(Ci), where e is a concatenation of cq and ei, and c 
is a concatenation of Co and ci. 

(13) Alice uses the coset of w + 71(6*2) as a key, and Bob uses the coset of 
i) + 77(62) as a key. 

2.2 Security of the protocol 

The security of the BB84 protocol can be proved by showing the security of the 
CSS code protocol (QKD using a CSS code) [5]. Maintaining the security, the 
BB84 protocol is related with the CSS code protocol. This kind of technique 
was first used in [2], in which the BB84 protocol is related to the EPP (Entan- 
glement Purification Protocol) protocol. If Ci and C2 satisfy the following three 
conditions, then a shared key is secure against general eavesdropping attacks. 

(a) C2 C Ci 

(b) If the crossover probability of first ^ bits of the BSC are smaller than or 
equal to po and the crossover probability of latter ^ bits are smaller than 
or equal to pi, then the decoding error probability of Ci as a part of a 
CSS code over the BSC, whose formal definition is given in Definitional 
is smaller than or equal to e. 
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(c) If the crossover probability of first ^ bits of the BSC are smaller than or 
equal to pi and the crossover probability of latter ^ bits are smaller than 
or equal to po, then the decoding error probability of as a part of a 
CSS code over the BSC is smaller than or equal to e. 

We set Po and pi to po = Qfo{l) + S and pi — + 5 in step ifTUIl . where 

Qfg, Qfi are the types of /o,/i (refer to 9 for the definition of the type), and 6 
and e are sufficiently small positive numbers. Throughout this paper, we assume 
Po < ^ and pi < i . 

We stress that the decoding error probability of Ci and have to be small 
over any BSC with crossover probability below pq and crossover probability 
below pi, instead of a single BSC with crossover probabilities po and pi. The 
necessity of such a requirement on decoding error probability is already observed 
in [HI , [3 Proof of Lemma 3] . 

The security of the BB84 protocol is usually evaluated by the mutual in- 
formation between a shared key and Eve's accessible information. In order to 
implement the BB84 protocol, the designer of the system has to find a pair of 
linear codes by which the mutual information between a shared key and Eve's 
accessible information is smaller than an acceptable level. To find such a pair of 
linear codes, we need a criterion according to which we can distinguish whether 
a particular pair of linear codes makes the mutual information smaller than an 
acceptable level. 

In the security proof of j2|, it is proved that the security of the BB84 pro- 
tocol against general eavesdropping attack is reduced to the security against 
uncorrelated Pauli attacks (Eve applies a random Pauli operator independently 
on each qubit sent through the channel). However, only a asymptotic upper 
bound on the mutual information is proved, and the authors do not present a 
sufficient condition for low mutual information on a pair of linear codes of a 
finite code length. 

In the security proof of j^j , Hamada presents a condition on a pair of linear 
codes ini Corollary 2] , and proves that the mutual information is upper bounded 
quantitatively by a pair of linear codes satisfying that condition. However, that 
condition does not aid choosing a suitable linear code, because we cannot easily 
decide whether a particular code satisfies it. 

By upper bounding the mutual information by a function of the decoding 
error probability e, we can find a pair of linear codes that makes the mutual 
information smaller than an acceptable level according to the conditions 
Because evaluating an upper bound on the decoding error probability of a code 
is not difficult, the conditions on a pair of linear codes are practically 

useful. The following theorem gives an upper bound on the mutual information 
as a function of the decoding error probability e. 

Theorem 1 // we use linear codes Ci and C2 that satisfy the conditions 

^ in the BB84 protocol, then the mutual information between a shared key and 

Eve's accessible information (including messages exchanged over the classical 
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channel) is upper bounded by 
1{U;E,S) 

< H (2(| + l)^e + 2exp {-e((5^n)}) + 4n(| + l)^e + Anexp {-e{d^n)} , 
where the base o/exp(-) is 2, Q{S^n) is given by 

S denotes the random variable of the information transmitted through the public 
classical channel, U denotes the random variable of a shared key, i.e., the coset 
of V + Tr(C2), and E denotes the random variable of Eve's eavesdropping result 
from transmitted qubits. 

This theorem is proved in Appendix ^ Note that the upper bound of the 
mutual information is vahd for finite n. 

3 Random privacy amplification 

To implement the BB84 protocol, we need a linear code Ci to be efficiently 
decodeable, which is used for error correction in step 1)12(1 . Under the conditions 
it is difficult to find a pair of linear codes Ci and C2 of which Ci is 
efficiently decodeable. On the other hand, since we do not decode in the 
BB84 protocol, we can evaluate the condition Q with an arbitrary decoding 
method. Therefore, first we choose a code Ci that satisfies the condition ^ 
and is efficiently decodeable. Then we will find a code C2 that satisfies the 
conditions @ and 0. Given a code Ci, choosing a code C2 with the condition 
@ is same as choosing a code that satisfies Cj*- C C^. 

If we fix a rate R lower than 1 — H(po +Pi) and choose a code of rate R 
at random with the condition j^), with high probability the condition Q will 
be satisfied [Sj Lemma 4]. In this section, we will prove that if we fix a rate R 
lower than 1 — and choose a code of rate R at random with the 

condition @), with high probability the condition @ will be satisfied. Some 
ideas used in the proof are borrowed from '3', '5 . 

We present the main theorem in Section l3.ll and the proof of this theorem 
in Section Then we consider the key rate of securely shared key in Section 
13.81 and compare our result with Mayers' in Section 

3.1 The code for privacy amplification 

Given a code C^^ of dimension r, we consider how to choose a code C^. Fix a 
rate R=r±^<l - ^(po)+ii(pi) ^ and let 

Am = { C2 C F2 I C2 is a linear space, 

dim C^=r + m, C } 
be the set from which we choose a code . 
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3.1.1 Minimum conditional entropy decoding 

To evaluate the decoding error probability, we employ the minimum conditional 
entropy decoding [S| Appendix B]. Let e be an error occurred in n bits binary 
vector, be the type of first ^ bits of e, and be the type of latter ^ bits of 
e. Then we define the conditional entropy of e as 

H.,P,P,,.5a)±i!ffl). 

In the minimum conditional entropy decoding, we find an estimated error e that 
minimizes Hc(e) and has the same syndrome, i.e., ei/J = ei/J, where H2 is 
parity check matrix of C^. 

3.1.2 The decoding process of a CSS code 

We assume that only phase errors occur because we will consider the decoding 
process by C^. Assume that a codeword \v + C2) is sent and a^f^\v + C2) is 
received, where 

e = (ei,---,e„). 

Compute the syndrome eTfJ and find an estimated error e. Then, apply the 
unitary operator cr!f' to cri'^'li) + C2) to correct the error. If 

a^^+'^\v + C2)^\v + C2), 

a decoding error occurs. 

3.1.3 Errors causing decoding errors 

We consider when decoding errors occur. Note that the condition e_ffj — eijj 
is equivalent to e + e e C^. For a linear code C^, if there exists a vector e 
such that e + e e and Ilc(e) < Ilc(e), the estimated error is e instead of 
e. If the unitary operator crl*^^*^' applied to a codeword of a CSS code \v + C'2), 
then we have 



K)6C2 



If {v + w) ■ {e + e) = Q for all v + w E Ci, the codeword is left unchanged by 
multiplication of a^^^'^K Because v E Ci, w E C2, and C2 C Ci, if e + e e Cj^, 
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then {v + w) ■ {e + e) = 0. Thus, if e + e £ C^, the errors are not estimated 
correctly but the received state will be corrected to the original state, and these 
errors do not yield decoding errors. In case of decoding a CSS code, we define 
the set of errors for each C^, which cause decoding errors, as 

£{C^) = {e e F''^ I 3e Hc(e) < Hc(e), e + ee C^\C^} • 

Definition 2 We define the decoding error probability o/C^ as apart of a CSS 
code over a BSC whose crossover probability of first j bits are p[ and that of 
latter ^ bits are p^ as 

Perr{Ci,p'o,p[)= ^ Qis), 

where Q{e) is a probability that e occurs in a BSC whose crossover probability 
of first J bits are Pi and that of latter j bits are p'q . 

The decoding error probability of Ci as a part of a CSS code is defined in the 
same way considering the decoding process of bit flip errors of a CSS code. 

Theorem 3 // we choose a code at random from A,n, for arbitrary /i > 0, 
we have 

PT{p,rr{C^,p',,p[) < + l)42-«(B(fl.P0.p0-p) 

ypo<po, p'l<Pl}>l-(| + l)'2-'™, 

where 

E{R,po,pi) = 

mm h |1 - i?- Hc(gi,go)r > 

go, 91 [ z 

and \x\'^ — max{a;,0}. Note that miug^ gj is taken over < <Zoj'?i l£ 1- Because 
D(g,\p,)+D(qo\po) ^ only ifqi = pi, go = PO; andR<l- MBll+JiiEi)^ have 
EiR,po,pi)>0. 

Consequently, we can obtain a code that satisfy the condition (jcj) with 
high probability by choosing a code at random from Am- 

3.2 Proof of the theorem 

Refer to 1^1 for the method of type used in this section. We also use the notation 
T^p p ^ as the set of binary vectors whose type of first ^ bits is and that of 
latter ^ bits is . is the direct product of the sets of all possible types over 
{0,l}t,i.e., xpL 
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We classify £{€2) by tlie types in P| as 

£{€2)= U f(p^,pj(C^), 

(PoPn) 

where £(p^^p^){C2) = ^((^2") ^(p^ p^)- First, we prove tliat if we clioose a 
code C2 at random from A„i, C2 satisfies the following property with high 
probability. Then we prove that the decoding error probability of C2 that 
satisfy the following property is small. Given arbitrary /z > 0, for all types 



\£{Pc,P^){C2)\ 



< 2-ni\l-}i,(P(,P„)-R\ + -lx) _ 



To prove this, we evaluate the average of — — j — over Co" € A^. Define 



(P<,Pv)^ 

the set of codes that cannot correct e as 

Bm{e) = {C^ GAm\eG£{C^)}. 

Define Cm{e) as 

C„(e) = {^2^ € A„J e e C^\Ci} 

and G as the set of bijective linear maps a on F2 that satisfies a{Ci) = . 
Then we have the following equalities: 

\CM\ 

= \{Ci eA^\e&Ci\Ci]\ 
= \{a{Ci) I e e a{Ci\Ci), a € G, is fixed} | 
= \{!3a{Gi) I /3(e) e l3a{Ci\Ci), a,peG, 
/? and G2 are fixed} | . 

Since there exists /3 G G such that e' = /3(e) for arbitrary e and e' e FjXCi^, 
|Cm(e)| does not depend on e e F2\Cj'- and 

_ EeeFg\C,^ l<^m(e)| 

EeeFg\c,^ 1(^2^ &Am\ee Gi:\G^}\ 
|F?\Cfl 

Ec.^eA^ \{e e F^\Cf | e e C2^\Cf }| 
iF^Cfl 

|F5\Cf| • 
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Prom the definition, it is obvious that |Cm(e)| = for e e . Hence 

\Ct\Ct\\A^\ 



|C„(e)| < 



< 



2" - 2'' 

2n— (r+m) ]^ ^—n-\-r 

\Am\ 

'2n—{r-\-rri) 

= |^„|2-"(i-^). 

Because the condition for C2 € to belong to Bm{e) is 3e Hc(e) < 
Hc(e), e + e e C2~\C'i", we obtain 



l^m(e) 



< 



J2 \Cm{e + e) 



eGFJ 

Hc(e)<Ho(e) 



eeFJ 
Hc(e)<Hc(e) 



while ^'^J*'^''^ < 1. Let = max{a;, 0} and note that if a, 6 > 0, then min{a + 
b, 1} < min{a, 1} + min{6, 1}. 

Using above definitions, we have 



lA 



- y 



\£(P0Pr,){C^)\ 



E 



\Bm{e)\ 

\Am\ 



< 



I'T'n 

I (n.-P^)l eeT, 



E 



J2 2-"(i-^),i 



(P(,Pv) 



eeFJ 
Hc(e)<Hc(e) 



= min < 



E 

(p;,p')eP| 



|T(%,p,)|2-»(i-«),l 



^ Hc(P^,P^)<He(P;;,P^) 

(PiP^)ePl 
Ho(P^,P;,)<Hc(P(.Pr,) 
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< \Pl\ max 2-"|i-«-«=(^o^;)l+ 

< (| + i)22-n|l-iJ-He(Pc,P^)| + 

Let Ab{iJ,,P(^,Prj) and ^g(/x) be 



> (| + i)22-n(|l-iJ-He(Pc,P^)| + -/^)| ^ 



Ag(/x) = A„\ y A6(/X,Pf,P^). 
(Pc,P^)6P| 

From the union bound and the Chebychev inequahty, we have 



1 



I Am I 



\A.m\ 

> 1_ V- \Ag{^i,Pc,Pr,)\ 

^ \Am\ 

2 

^ f « + 1^22-n|l-K-H,(P^,P^)| + 

> 1- V ^2 ^ ^ 

/n , l)22-n(|l-iJ-He(P<;,P„)| + -,z) 

> i_(_ + i)22-M" 

Next, we evaluate the decoding error probability of G Ag{fi). Let Pq < po 
and p'l < pi, and Q{e) be a probability that e occurs in a BSC whose crossover 
probability of first ^ bits are p[ and that of latter ^ bits are pg. Then the 
decoding error probability of C2 as a part of a CSS code is 

Perr{C^,p'o,p[) 

= E E Q(-) 

(P<,P,)6P| eef:(p^.,p^)(C2^) 

_ |g(P;,Pj(C^)l ^^^„ . 

(P P )ep2 l-'CPc.P^)! 
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where 



< ^ (!! + l)22-n(|l-i?,-He(Pc,P^)| + - 

(PoP„)GP| 



E{R,Po,Pi) = 

"D(giK) + I?(qo|p;,) 



mm 

go, 91 



|l-i?-He(gi,go)r 



Lemma 4 



min E{R,Pq,p[) = E{R,po,pi). 

0<Pq<PQ 
0<p'i<Pl 

We prove this lemma in Appendix From this lemma, we have 



,n 

Then Theorem |21 is proved 



3.3 Achievable key rate 

We proved that if we fix a code and choose a code of a fixed rate 
i? < 1 — at random with the condition C C^, the decoding 

error probability of as a part of a CSS code is small with high probability. 
Consequently, we can conduct random privacy amplification with a code C2 of 
a rate higher than ^(po)+^iPi) ^ 

If we estimate an error rate in a lump (test bits in each basis are lumped 
together and a single error rate is computed), an estimated error rate is 
instead of po and pi. Thus, we can conduct random privacy amplification with 
a code C2 with a rate higher than H(2£i±Hi). Since the entropy function is 
concave, we can conduct random privacy amplification with a code C2 of a 
lower rate by estimating error rates separately, which enables us to share a 
longer key. 



3.4 Comparison with Mayers' evaluation 

In this section, we compare our result with Mayers'. In case of estimating an 
error rate in a lump, we can conduct random privacy amplification with a code 
C2 of a rate higher than H Because there exists efficiently decodeable 

codes whose rate is fairly close to 1 — H ( p°+pi ) and whose decoding error 
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error rate 

Figure 1: Comparison of achievable key rates. 

probability is small, we can securely share a key with a rate lower than 1 — 
2H {^^^^). With Mayers' evaluation of minimum Hamming weight of C^\C^ 
in we can securely share a key with a rate lower than 1 — H (^^^-5^) — H(po + 
Pi), where 1 — H ( P"+pi ^ is the rate of Ci for error correction and H(po +Pi) is 
the rate of C'2 for privacy amplification. 

According to the evaluation of the decoding error probability, we showed 
that the tolerable error rate can be increased from 7.5 % to 11 % in the BB84 
protocol with random privacy amplification. Figure ^ shows the secure key rate 
of this paper and Mayers' against error rate, and the key rate falls to at the 
point of 7.5 % and 11 % respectively. 

4 Conclusion 

For a fixed code Ci , we showed that we can decrease a rate of randomly chosen 
code C2, keeping the BB84 protocol to be secure. Consequently, we proved that 
the BB84 protocol with random privacy amplification can tolerate severer noise 
and can share longer keys. 
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A Proof of theorem [T] 

In this appendix, we prove Theorem^ i.e., we prove that we can securely share 
a key against general eavesdropping attacks with the linear codes Ci and C2 
that satisfy the conditions in Section Basic ideas in this proof are 

borrowed from 17] . 

The outline of this proof is similar to the proof in . We introduce a class 
of CSS codes and the CSS code protocol in Sections lA.ll and IA.2I respectively. 
Then we define some notations used in this proof in Section FA.SI After that, 
we define Eve's attack mathematically and relate the BB84 protocol to the CSS 
code protocol in Sections I A. 41 and I A. 51 respectivelv. In Section FA. 61 in order to 
bound the mutual information, we bound the fidelity, which is defined in Section 
I A. 51 Finally, we upper bound the mutual information of a shared key and Eve's 
accessible information in Section I A . 71 using the result in Section lA. 61 

A.l A class of CSS codes 

In this section, we define a class of CSS codes. A CSS code Q is constructed 
from two linear codes Ci and C2 that satisfy C2 C Ci. A codeword \4>u) € Q is 



where it is a coset representative of C1/C2. A class of CSS codes is {Qxz} that 
are parametrized by coset representatives x G F^/Ci and z E F2/C2, and a 
codeword \4>uxz) e Qxz is 



A recovery operator for a CSS code Qxz is a TPCP (Trace Preserving Com- 
pletely Positive) map on L(7i'*") that represent the measurement of syndrome 
and the unitary operation of error correction, where 7i is a Hilbert space of 
dimension 2, and L(H) is the linear space of operators on Ti.. We denote by 
TZxz the recovery operator for Qxz- 

A.2 The CSS code protocol 

To prove the security of the BB84 protocol, we relate the BB84 protocol with 
the following CSS code protocol |Sj Section 4]. In this section, we use bold large 
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letters for random variables and small bold letters for their realizations, e.g., x 
denote a realization of a random variable X. We also use a notation Ea, as the 
expectation operator over X. 

Suppose Alice chooses coset representatives u e C1/C2, x € Fj/Ci, z S 
F^VC^ at random and send Let An be a TPCP map on L(H®") 

representing Eve's eavesdropping attack, and £^ be a random variable that is 
Eve's measurement result. According to |12[ Section 5.3], we can bound the 
mutual information between U and E as 

1{U;E\X ^x,Z z) <S^,, (1) 

where S^z is the entropy exchange |T21 Section 5] after the system suffers a 
Eve's attack An and recovery operator TZxz, i-e., 

Sxz = S{p), 

V 1^1/^21 ^^c/C, 

and S{-) denotes the von Neumann entropy. Let F^z be the entanglement 
fidelity of above process, i.e., 

F^z = (^x^IpI^x^)- 

Then, by the quantum Fano inequality, Eq. (24) of |12[ Section 6.2], Sxz is 
bounded as 

Sxz<m~Fxz) + {l~Fxz)2n, (2) 

where H(-) is the binary entropy function. Combining Eqs. and (0) and 
taking the average of the both sides over x,z, we have 

E\X, Z) < H(l - E^zF^z) + (1 - E,,F,,)2n, (3) 

where we used concavity of entropy function, i.e., Ea;zH(l — F^z) < H(l — 

ExzFxz)- From Eq. (27) of (61 Section 5], the entanglement fidelity F^z is 
bounded as 

l-ExzFxz< ^(e^'S,), (4) 

where £ is the set of uncorrectable errors of a CSS code Q, 

7'(e„e,) = {n^J[In^An]{m{^''mt.J, 
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A.3 Notation 



First, we fix the positions of remaining 2n bits out of {A+9)n bits in step @, and 
represent these positions by T. Lets a^jb^ S Fj" be the subsequences of a,b 
that correspond to T, which include n bits where Ui — bi — and n bits where 
ai = &i = 1. We further divide the positions T into four blocks, Tq, Tq, T^, T^. 
Tq, Tq consist of the positions that at = bt = 0, and T^, T* consist of the posi- 
tions that Qi = hi = 1. Tq, are the positions used for generating a key, and 
Tq, Tl are the positions used for estimating an error rate. Tq , Tq, T^f , Tl depend 
on aT,bT,pos, where pos represents how to divide the remaining positions T 
into the positions for generating a key and the positions T* for estimating 
an error rate. Note that T*^ consists of Tq and T^, and T* consists of Tg and 



to Tq*^, T^, Tq*, Tl T^ T* respectively. Subsequences of c,d,k e F^'*+®'" are 
defined in the same way. 

A. 4 Eve's attack 

Let a TPCP map A : L(7^«^(4+e)n-) L(-^»(4+e)«) represent Eve's eavesdrop- 
ping attack (plus channel noise) on transmitted (4 -I- d)n qubits. Note that A 
does not depend on a, b,pos, tt. In the BB84 protocol, Alice chooses (4 -t- d)n- 
bit string k and sends it with either {|0), |1)} or {|+), |— )} basis according to 
a, i.e., Alice sends _ff["l|fe), where = (g) ■ ■ ■ (g) iJ'^e'+e), and if is a 

Hadamard transformation. Bob receives A{H^''^k){k\H^°-y), and^ measures it 
by either {|0), |1)} or {|+), |— )} basis according to b and obtain k. Note that 
[H (g) i?]|*> = 1*), where 



and that we can denote Eve's attack by a unitary operator on Bob's system and 
Eve's system ^^(4+9)" ^ Ue, i.e.. 



where |e)o is a state in He, and Ube is an unitary operation on 'H^^'^^)" ig He- 
We can mathematically regard Alice's sent bits k and Bob's received bits k as 
follows. First, Alice and Bob share a bipartite state 




1^) 



|0)|0) + |1)|1) 
V2 



UBE[H^°'^\k)<E>\eo)], 




1 



V2(4+e)» 



1 



\/2(4+'')» 



(4 + 9)™ 
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Then Bob's system suffers Eve's attack and the bipartite state becomes 

Wabe) - (/A®C/sij)[|*('+')">®|eo>] 

= J ^'"l|O^C/Bij(i/["l|Z)0|eo)), (5) 

where TrE[WABE){^ABE\] = [I ® and TteI] denotes 

the partial trace over He- After that, Ahce measures her system by the {|0), |1)} 
basis or the {|+),|— )} basis according to a, and obtain k e Fj^^*-*". This 
measurement changes the state in Eq. (O to 

i?["l|fc)®C/s£[-ff["l|fc)® |eo)]. (6) 

Then Bob measures his system in Eq. © by the {|0), |1)} basis or the {|+), |— )} 
basis according to 6, and obtain k. 
Let 

P(c,d) - (vl/(^/''"|[X®^](|vI/(4+«)«)(vI/(4+e)«|)|vI;(^^^^^ 

where c, d g Fj*^^^^". Since Ahce and Bob measure the qubits by {|0), |1)} basis 
when Oi = 6i = and by {|+), |— )} basis when at = bi = 1, we can relate c,d 
with fc , fc as 

Crpt = krpt - k^t = /O 

dyt = kxt - k-Tt = fi, 
where fo and fi are the ^-bit strings from which we estimate error rates. 



A. 5 Relating the BB84 protocol to the CSS code protocol 

In the BB84 protocol, we select the linear codes Ci and C2 that satisfy the 
conditions from /o, /i- We prove that the following protocol is secure. 

Alice randomly selects coset representatives u, x, z, where u e 7r(Ci)/7r(C2), 
X £ F2/7r(Ci), z £ ¥2/^(02 ), and u corresponds to a shared key in the BB84 
protocol. Then Alice selects |Z)(g)|m), where Z G F2 , m g Fj^^^-*", I corresponds 
to test bits, and m corresponds to discarded bits in the BB84 protocol. Then 
Alice sends 

H^''^[\<l>^a,.)<E>\l)<E,\m)] 

to Bob, where = H"^ (g) • • • (g) H°'fA+<>)r^ . Bob measures the test qubits, and 
Alice and Bob obtain /o, /i. Then, Bob corrects errors and obtain a key. 

We consider this procedure as follows. First, Alice and Bob share a bipartite 
state 

P = ® ® |^(2+e)»)(^(2+e)n|^ 
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where 



xz j 



Then, Bob's system suffers a Eve's attack A., and p becomes p' . After Ahce and 
Bob obtain measurement disagreements /o, /i, bipartite state is 

„ ^ n(/o, /l) ® /»(4+29)n]p'[/»2n ^ jj^j^^ j^) ^ J»(4+2e)«] 



where 



Tr [[/«52n ^ n(/o, /l) (g) /®(4+2e)n]p/] 

n(/o,/i) = 1^/0/1 >(*/o/i I 

S0:SiGF7 

Then Bob perform the recovery operation TZ^z , and we have 

p'" = [In ® n^z (»^(6+2e)n]{p")- 

We define the entanglement fideUty of the system that corresponds to a shared 
key as 



^xzlfofiaxbTposTT — Tr 



[\Kz){Kz\®I^^'^''^'']p"']- (7) 



To bound the mutual information between a shared key and Eve's eaves- 
dropping key, we evaluate Eq. lO as follows. Since we transmit the qubits in 
the {|+), |— )} basis when = 1, and from Eq. we can bound Eq. |7J as 

1 ^xzFxz\fofiaTbTpos-iT 

< Y 'PicT>;,dj.f\fo,fi) 

(c k-d„k)e£(-n{Ci)) 
-'o 1 

+ V{cj,.,dj..\fo,fi), (8) 

where £ is the set of uncorrectable errors by the CSS code that is constructed 
by 7r(Ci) and 7r(C2), and £(7r(Ci)), £(7r(C^)) are sets of uncorrectable errors 
by 7r(Ci) and 7r(C^) as a part of a CSS code respectively. Note that 7r(Ci) 
corrects errors caused by CTz and 7r(C^) corrects errors caused by ax in qubits 
transmitted by the {|+), |— )} basis, and that the second inequality is due to 
that the decoding error of a CSS code occurs when a bit flip error or a phase 
flip error is uncorrectable. 
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A. 6 Bounding the fidelity 

In this section, we evaluate Eq. (|SJ) by taking the average of parameters, a, b, tt, /q, /i ■ 
Let fix one realization of {ctjcLt) and vary aT,bT,pos at uniformly random. 
Note that subsequences Cj-k , Cjj* , Cj-k , Cxt , drpk , dj^t , dj^k , dj-t of Ct, rfr vary ac- 
cording to ar, bx^pos. Using a lemma |H1 Lemma 5], we have 

Pr{|Q,^,(l)-Q,^,(l)| >5or \Qd,Al) - Qd^Al)\ > s} < exp {~Q{S'n)} 

Pr { IQd^, (1) - Qd,, (1)1 ><5 or IQ,^, (1) - Qe^, (1)| > s] 

<exp{-e((52n)}, (9) 

where the base of exp(-) is 2, and 8((5^n) can be explicitly given as 

0(^'«) = - 2 log(n + 1)^2. (10) 

For each realization Cj^t = /q , dj.t — fi^ we decide linear codes Ci and C2 that 
satisfy the conditions 

First, we consider Ci. Assume that Ci is used over a BSC whose crossover 
probability of first ^ bits are Qc ^.(1) and that of latter ^ bits are Qd (,(1)- 

From the condition ©, if Qc ^(1) < Qfoi^) + S and Qd ^(1) < Q/i(l) + S, 
then the decoding error probability of Ci as a part of a CSS code is lower than 
or equal to e. We can write the decoding error probability as 

E HP<.P.)QBSc{rCPopJ = E QBSc(.e)<e, (11) 

2 

where Qbsc{^) is a probability that e occurs over a BSC whose crossover prob- 
ability of first ^ bits are Qc ^ (1) and that of latter ^ bits are Qd ^ (1); ^(Ci) 
is a set of uncorrectable errors of Ci, and e(^p^,p^j) is the ratio of uncorrectable 
errors in T^p^ p y i.e., 

_ l^^(P,.P„)nf(Ci)| 

^(^^c^-P.,) - \^ \ ■ 

^^{Pi,P^V 

From Eq. ((TT)l . wc have 

^«3=..^Q<^.J^^Sc(T('^,^^,^Q. )) < £• 



Using type property in 9, Lemma 2.6], we have 
QbSc(T(q )) > TTT— iTa^"" 



i ^1 ^1 i 



(1 + 1)2 (f + l)2 
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Thus, we have 

e(Q.^,,Q.^j<(f + 1^. (12) 

Consequently, if |Qc^,(l) - Qf„{l)\ < S and |Qd^,(l) - < S, then 

the ratio of uncorrectable errors of Ci in T/^, ^ s is less than or equal to 

(1 + 1)^ 

Define J(cyfc, dj^fc, /o, /i, Ci) as follows: U {crpk , drpk) e f(Ci), J {crpk , drpk , fo , fi , Ci) — 
1. For the others, J{crpk,drpk, fo, fi,Ci) = 0. If (9/o(l) or (5/i(l) is too large 
and we abort the BB84 protocol, then J{crpk, drpk, fo, fi, Ci) is always 0. Note 
that Ci is decided from fo, fi- From Eq. (|5J|, \Qrpk{l) — Qfoi^)\ < 6 and 
\Qrpk{l) — < S with high probability. When e,e' E T^p^ p y there exist 

a permutation tt such that 7r(e) = e'. Thus, if we consider the decoding error 
probability of 7r(Ci) averaged over permutation tt, then we can consider that an 
error with the same type occurs with same the probability. We proved that if 
IQyfc (1) — Q/o(l)l ^ ^ and \Qrpk{l)~Qf^{l)\ < S, then the ratio of uncorrectable 
errors of 7r(Ci) in T^q ^ is less than or equal to {^■ + l)^e in Eq. (|12|l . 

Then we have 

J [opk , d , /o , /i , 7r(Ci ) ) 

< (^ + lfePr{|Oc,,(l)-Qc,,(l)| <<5and|Qd^,(l)-Qd^,(l)| <5} 

+ Pr{|g,^,(l)-g,^,(l)| >5or \Qa^Al)-Qci^Al)\>5] 

< (| + lfe + exp{-e(<5^i)}. (13) 

Taking the average of Eq. H13|l over {cT,dT) and exchanging the order of 
the averages, we have 

^aT,bT,pos,n^V{fo,fi) X/ T^i^T^ , (^Tflfo, fl) 

(c fe,d fc)e£(^(Ci)) 

J (cyfc , dyfc , /o, /i , 7r(Ci)) 
< (^ + l)2e + exp{-e(<52n)}. (14) 

In the same way, we have 

Ea^M^^pos.^Kvifo.f,) r{cj,k,dj,k\fo,fi) < (^ + l)2e + cxp{-e(52„)}.(15) 

{c^k,d^k)e£{rr{C^)) 

From Eq. ((Tl|l and ifT^ . we can rewrite Eq. © as 

< 2(- + l)h + 2 exp {-e(52n)} . (16) 
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A. 7 Bounding the mutual information 
Using Eq. ||2J), we can bound the mutual information as 
1{U; E\X, Z, At, Bt, POS, iT, Fq, Fi) 

< H (l — ¥.aT,bT,pos,TT^V{fo.Ji)^xzFxz\fofiaTbTpos7T) 
+ (1 — EaT.bT,pos,TT^V{foJi)^xzFxz\fofiaTbTposTT)'^^ 

< H (2(^ + 1)^6 + 2 exp{-e((52n)}) 

+4n(^ + l)2e + 4nexp{-e((5^n)} , (17) 

where X, Z, At, Bt, POS, U, Fq, Fi denote the random variables of x, z, 
ttT, bT, pos, TT, /o, fi- Using the chain rule of mutual information 13, Theorem 
2.5.2] and mutual independence of U from X, Z, At, Bt, POS, iT, Fq, Fi, 
we can upper bound the mutual information of the shared key and Eve's all 
accessible information as 

I(J7; E, X, At, Bt, POS, iT, Fq, Fi) 

< l{U;E,X,Z,AT,BT,POS,n,Fo,Fi) 
= l{U;E\X,Z,AT,BT,POS,n,Fo,Fi) 

< H (2{^ + ife + 2exp{-e{6^n)}^ + 4n(^ + ife + 4ncxp {-e{S^n)} , 
where <d{S^n) is given by Eq. l(Tn)l. 



B Proof of lemma |H 

In this appendix, we prove 

min E{R,Pq,p[) = E{R,po,pi), 

0<p'o<PO 
0<p[<Pl 

where we assume po < ^ and pi < i. First, we fix p'q and p[ arbitrary in the 
range < Pq < Po, Q ^ p'l ^ Pi, and analyze E{R,Pq,p[) as a function of R in 
Section iB.ll Then we prove that E{R,p'q,p'i) takes the minimum at p'q = po, 
p'l = pi for arbitrary < i? < 1 in Section [6.21 



B.l Analysis of E{R,Pq,p[) 

Note that Pq and Pi are arbitrary fixed in the range < Pq < Pq, < p[ < pi 
in this section. To express E{R,pQ,pi) as a function of R,Pq,p[ explicitly, we 
define 



F{R,qo,qi) = 



Diqo\p'a)+D(qi\p'i) + 1 _ _ H(qo)+H(gi) H(go)+H(gi) ^ i _ 

Diqo\p'o)+D{qi\p'i) H(go)+H(gi) ^ i _ 
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Because it is obvious that E{R,Pq,p[) = for i? > 1 
mp'o)+ii{p[) Section ED 



H(pn)+H(p',) 

2 — assume 



First, we consider the case ^'-v>)+ii(qi) <; ^ — i?. If we set 



then we have ^ 
090 



Qi = 



90=95 



„ 3f (fl.9o,9i) 



91=91 



0, and ^m^^ > 

' ^9q 



0, ^ ^^gf-^^^ > for < go,gi < 1- Thus, if "^^"^+"^^^'^ < I - R, then 
-F(i?, qo,qi) takes the minimum at (^q, ql) and we have 



E{R,p'o,p[)^l -R-log{^+ Vl-Pol - log{VPi + Vl-Pil 

Next, we consider the case ^('^o)+h(9i) > ^ — i?. i^(_R, go, 9i) takes the mini 

+ 
2 



• j-u H(qo)+H(9 

mum m the range ^ ' — — 



>1~R. Because we assumed i? < 1 _ M£q)+2M) ^ 
go and qi must be qa > pf, or qi > p'^ in order to satisfy ^^'^"•'"^^^'^^^ > 1 — i?. 
If qo < Pq and qi > p[ , then ^^'^°^Po)+Di'}i-\Pi) ^^^-^ j^g smaher by taking larger 
go and smaUer gi while maintaining the condition > 1 — R. If 

go > Pq and gi < p'j^, then -^t9obo)+P(9ibi) ^g^^^ smaller by taking larger gi 
and smaller go while maintaining the condition > I — R. Thus, go 

and gi must be go > p'q and gi > p[ for ^'-i°^Po)+D{qi\Pi) ^j^g minimum. 

Thus F{R, go, gi) is minimum at (go, 91) that satisfy — I — R. When 

= 1 - i?, we can expand °iio\p'o)+DMp{) 

D{qo\p'o) + D{qi\p[) 



Because 



: {~qo logPo - (1 - 90) log(l - p'o) 

-91 logp'i - (1 - 91) log(l - p[) - H(go) - H(gi)} 



1 



log 



dH(go) 



a -p'o) 
log 



90 
1 



1 I log ^ - log , 

2 I Pi (l-Pi) 



dgo 



log — - log 
90 



(I-90)' 



the tangent of the curve 



H(go)+H(gi) 



= 1-R 



91 



(18) 



(19) 
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at {qo,qi) is 



i <j log ^ - lo, 



1 



1 



(90 - 9o) + -j^ i log — - log 



1 



1 



qo ' (1 - qo) 
As is shown in Eq. p8|) . the curve 

D{qo\p'o) + Diq,\p[) 



91 



(gi - gi) = 0. 



(20) 



2 — 1 — -R, and a takes the minimum at 
the point where curve ((T^ and hne (pn|l touch each other under the condition 

H(go)+H(gi) 
2 



is hnear under the condition 
ire curve ((T^ a: 
1 — R. Then, {qo,qi) satisfy 

and we can further rewrite 

1 





1 


log 






90 




1 


log 






91 



Thus, if we set 



(1 - 90) 
1 



90 

91 

H((7o) + H(9i) 



1 - R, 



then F{R,qQ,qi) takes the minimum at ((70,91)- Because ^ < and ^ < 
for Po < 5 and p'l < ^, go and qi are decreasing functions of /3. Because we 
assumed 1-R> SMIIHpI), we have /3 < 1. If /? < i, then < 
H(go)+H(gi) = 1 _ ^ and F{R,qQ,qi) takes the minimum at (95,9^). Thus, 
i</3<l. 

Consequently, we can write E{R,pQ,p'i) as 



E{R,p'o,p[) 



{ i-i?-log{v% + v/i^}-log{v^+v/i^} 
for i? < 1 - SMl+HM) 

D(go|Po)+-D(gib'i) 

^ for 1 - H(go)+H('?i) < i? < 1 - h(pq)+h(p'i) 







for 1 - 



H(p;,)+H(p;) 



< i?. 
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B.2 The minimum of E{R,pQ,p[) 
Next, we evaluate 

min E{R,Po,p[) 

0<Pq<po 
0<p'^ <Pl 

for arbitrary fixed rate R. If H(go)+H(gr) < i _ 

EiR,p'a,p[) = 1-R- log{V^+ v/T^} - log{Vpl + VT^}. (21) 
Eq. lf?T|l is a decreasing function of p'q^p'i for pf, < ^,p[ < i, because if we set 



> 



for Pq < i and /(po) is an increasing function of p'q. If ^('?o^+^^'?i) > 1 — i?, 
then 



E[K,Po,Pi) r 



Assume E{R,pQ,p[) takes the minimum at (pQ,p'i) with p'q < po- Because 
Po < Qoi we define (pg,p") such that pg < pg < (/g and p'j^ = p". Then 

EiR,p'o,p[) = 

> 



^(90 bf,) 


+ ^(91^) 




2 


^(90 K) 


+ ^(91 IK) 




2 


^('JolK) 


+ ^(91^) 



where 



> ^ ^E{R,Pq,p^), 



90 

H(<7o)+H(gi) 



(p;,')'^ + (i-p;,')'^ 

{p'ir + {i-p'{r 
1 - i?. 



Note that the first inequality is due to that pg is closer to qo than pg, and the 
second inequality is due to that (go:9i) is the point at which )+D{qi\Pi ) 

takes the minimum. Thus, E{R^pQ,p[) does not take the minimum at (pQ,P2) 
with Pg < Po- In a similar manner, we can show that E{R,pQ,p[) does not take 
the minimum at (pg , p[ ) with p[ < pi . Consequently, we have 

niin E{R,Pq,p[) E{R,po,pi). 

o<Pi<pi 
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